GlcoinCore/RTL
1
0
Fork 0
mirror of https://github.com/Ride-The-Lightning/RTL.git synced 2026-08-17 13:06:58 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
RTL/release-notes/Release-notes-0.15.10.md
saubyk 234956b174
Update project dependencies to resolve Dependabot security alerts 
Applies the fixes from the open Dependabot PRs (#1648, #1649, #1650) in a
single pass on the release branch, regenerating the lockfile from scratch.

axios 1.16.0 -> 1.18.1 was the only production exposure (10 advisories).
Transitive deps moved to their fixed in-range versions (fast-uri 3.1.4,
form-data, qs, tough-cookie, tar, del, globby); dev toolchain took safe
bumps (nodemon 3.1.14, eslint 9.39.5, @typescript-eslint 8.65.0).

Drops the unused protractor devDependency: no e2e directory, no config and
no e2e target in angular.json, but 100 packages and the deprecated request
stack behind it. That clears both critical advisories.

npm audit: 50 (2 critical) -> 29 (0 critical); production deps 1 -> 0.
Remaining findings are dev-only tooling needing an Angular 21 migration
rather than a version bump.

Verified: lint, 204 frontend specs, backend + frontend production builds,
and 19 API checks against the docker regtest fixture covering LND, Core
Lightning and Eclair (getinfo, channels, peers, invoices, payments and
forwarding history).
2026-07-28 20:44:46 -07:00

2.5 KiB
Raw Blame History

Release Notes — 0.15.10

This document collects the changes that go into the 0.15.10 release. Each PR merged for this release should add its entry under the appropriate section below.

Code Health

  • Batch dependency update resolving the open Dependabot security PRs (#TBD). Dependabot had three open security PRs against master (#1648, #1649, #1650). Rather than merging them piecemeal (they conflict with each other on package-lock.json and target the wrong branch for the release flow), the fixes were applied in one pass on the release branch. The only production exposure was axios, carrying ten advisories at 1.16.0 — prototype pollution in request-option merging, formDataToJSON recursion DoS, maxBodyLength bypasses on fetch/HTTP2 uploads, and a NO_PROXY bypass — now on 1.18.1 (a patch above Dependabot's validated 1.18.0, which was superseded during the batch). The lockfile was regenerated from scratch rather than incrementally patched, and the flagged transitive deps were moved to their fixed in-range versions (fast-uri 3.1.4, plus form-data, qs, tough-cookie, tar, del and globby). The dev toolchain took safe patch/minor bumps: nodemon 3.1.14, eslint 9.39.5, and @typescript-eslint/* 8.65.0.

    The unused protractor devDependency was also dropped. It had been dead since the Angular scaffold that introduced it — no e2e/ directory, no protractor.conf.js, and no e2e target in angular.json, leaving a single line in package.json as its only reference — while dragging in 100 packages and the deprecated request stack. Removing it clears both remaining critical advisories (request, form-data) along with fourteen others (adm-zip, selenium-webdriver, webdriver-manager, xml2js, tmp, rimraf and the rest of the webdriver chain).

    npm audit: 50 vulnerabilities (2 critical, 37 high, 10 moderate, 1 low) → 29 (0 critical, 23 high, 6 moderate), and production dependencies are now clean at 0 (from 1 high). Everything still flagged is dev-only build tooling that cannot be fixed by a version bump: the Angular CLI chain (@hono/node-server and @modelcontextprotocol/sdk need Angular 21, i.e. @angular/core ^21 and TypeScript ≥5.9 — a framework migration, not a bump; #1650 is left for that work), the @angular-eslint line, and the karma/jasmine stack. None of it ships in the released bundle.